fix(server): treat undefined origin as non-CORS, reject empty origin string

[AAliKKhan]

Closes #39108

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Both isAllowedCorsOrigin and isAllowedRequestOrigin used if (!input) return true to handle missing Origin headers. The !input coercion treats an empty string "" the same as undefined, so clients sending an empty Origin: header bypass all CORS checks.

Fix: use input === undefined so only the absence of the header is treated as a non-CORS request. An empty origin string falls through to the normal validation and gets correctly rejected.

How did you verify your code works?

Checked the call sites in pty.ts where request.headers.origin can be string | undefined. An empty string now hits the .startsWith() checks which all return false, so the request is properly rejected.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

This pull request has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new pull request that follows our guidelines.